fix(security): cancel RLM work on host teardown

[sethkarten]

Summary

• abort in-flight kernel host requests during kernel disposal, kill, and stop
• propagate the host abort signal through the typed rlm.run bridge
• cancel an already-admitted child run exactly once when its kernel host disappears, and remove listeners after settlement

This is the host-cancellation portion extracted from #1159 and proposed directly against current main.

Risk

Medium. Cancellation remains cooperative; an unresponsive child can outlive the cancellation request until the existing bounded kernel-disposal wait expires. The new behavior only applies when the owning kernel host is torn down.

Provenance

Extracted from independently authored commits a3ba5dba6e8c280caa20cdca88f057810c35bb1a and 8d47a2e9191b6d2b516c979b19c7a8fb9b3b2999 in #1159. Their exact SHAs are recorded in the commit message. The separate clipboard changes from the first source commit are intentionally excluded here.

Validation

• npm run check
• npm run test -- test/agent-session-recursion.test.ts — 97 passed
• focused Biome check on all changed TypeScript files
• git diff --check origin/main...HEAD

Review focus

Please focus on abort-signal lifetime, listener cleanup, idempotent child cancellation, and disposal/restart ordering.

---

Note

Medium Risk
Cooperative cancellation on kernel teardown affects all in-flight rlm.run comm work and RLM child lifecycle; stuck children may still run until the existing bounded dispose wait expires.

Overview
Kernel host requests now receive an AbortSignal from a shared AbortController that is aborted on shutdown, kill, dispose, and resource cleanup; the signal is passed through HostRequestHandler and the rlm.run bridge into runRlmChild / _startRlmChildRun.

RLM child spawns honor that signal with throwIfAborted() at admission checkpoints, a one-shot abort listener that calls _cancelRlmChildRun (including aborting an admitted child session), and removal of the listener when the run settles. If cancellation or validation fails after a child session directory was created, that directory is recursively removed so orphaned sub-* dirs are not left behind.

On kernel restart, a fresh controller is created when the previous signal was already aborted. A related TODO about plumbing abort through AgentSession.prompt is removed because host-request cancellation is now wired.

^{Reviewed by Cursor Bugbot for commit 6a6ed7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cancel in-flight RLM child runs when the IPython kernel host tears down

• Adds an AbortController (hostRequestController) to KernelManager that is aborted on shutdown, kill, dispose, and disposeSync, propagating an AbortSignal to all active host request handlers.
• Extends HostRequestHandler, createRlmRunHostHandler, and AgentSession.runRlmChild / _startRlmChildRun to accept and forward the AbortSignal, so in-flight RLM child runs are cancelled when the kernel stops.
• _startRlmChildRun checks signal.throwIfAborted() at key checkpoints and registers an abort listener that transitions the child run to cancelled with a descriptive reason.
• A fresh AbortController is created in doStart if the previous one was already aborted, so restarted kernels accept new host requests.
• Risk: any in-flight rlm.run host request will now receive a cancellation error on kernel teardown rather than running to completion.

Changes since #1253 opened

• Added cleanup logic to remove abandoned child session directories when RLM subagent name validation or abort signal processing fails [6a6ed7d]
• Added test coverage for child session directory removal when host cancellation occurs during name validation [6a6ed7d]

^{Macroscope summarized 0c0c75c.}

[jonaowen]

The cancellation ownership is coherent at exact head: each request captures its kernel-generation signal; all teardown paths abort the controller, restart replaces it before new admission, admission is fenced around awaits, and the once-listener closes the post-registration/pre-publication gap. _cancelRlmChildRun is idempotent, late runtime publication observes cancelled status, and listener cleanup is in the run finally. The real-child dispose and handler-abort tests gate the central lifecycle. A restart-generation regression would be useful but is not merge-blocking. GO at ee15990840fa9db51e45827653bd4c675e04b330.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0c0c75c. Configure here.}

[Apocrathia]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T15:55:56.734394Z	6a6ed7d	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 6a6ed7d36b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".